@agent-native/core 0.149.5 → 0.151.0

package/corpus/templates/content/app/hooks/use-documents.ts

@@ -1,4 +1,5 @@
 import {
+  callAction,
   useActionQuery,
   useActionMutation,
 } from "@agent-native/core/client/hooks";
@@ -7,6 +8,7 @@ import type {
   ContentDatabaseItem,
   Document,
   DocumentCreateRequest,
+  DocumentListResponse,
   DocumentPropertiesResponse,
   DocumentUpdateRequest,
   DocumentUpdateResponse,
@@ -15,7 +17,7 @@ import type {
   DocumentTreeNode,
 } from "@shared/api";
 import type { QueryClient } from "@tanstack/react-query";
-import { useQueryClient } from "@tanstack/react-query";
+import { useQuery, useQueryClient } from "@tanstack/react-query";
 import { toast } from "sonner";
 
 import type { DocumentUpdateConflictResponse } from "../../actions/update-document";
@@ -63,6 +65,74 @@ export const LIST_DOCUMENTS_QUERY_KEY = [
   undefined,
 ] as const;
 
+const DOCUMENT_LIST_PAGE_SIZE = 200;
+
+export async function fetchCompleteDocumentList(
+  fetchPage: (offset: number, limit: number) => Promise<DocumentListResponse>,
+) {
+  const documents: Document[] = [];
+  const documentIds = new Set<string>();
+  let offset = 0;
+  let expectedTotal: number | null = null;
+
+  while (true) {
+    const page = await fetchPage(offset, DOCUMENT_LIST_PAGE_SIZE);
+    const { pagination } = page;
+    if (!pagination) {
+      throw new Error(
+        "list-documents returned no pagination boundary; refusing to treat the result as complete.",
+      );
+    }
+    if (
+      pagination.offset !== offset ||
+      pagination.limit !== DOCUMENT_LIST_PAGE_SIZE ||
+      pagination.returnedItems !== page.documents.length
+    ) {
+      throw new Error(
+        "list-documents returned inconsistent pagination metadata; retry the complete read.",
+      );
+    }
+    if (expectedTotal === null) expectedTotal = pagination.totalItems;
+    if (pagination.totalItems !== expectedTotal) {
+      throw new Error(
+        "Documents changed during paginated discovery; retry the complete read.",
+      );
+    }
+    for (const document of page.documents) {
+      if (documentIds.has(document.id)) {
+        throw new Error(
+          `list-documents repeated document "${document.id}" across pages; refusing an ambiguous result.`,
+        );
+      }
+      documentIds.add(document.id);
+      documents.push(document);
+    }
+
+    const expectedNextOffset = offset + page.documents.length;
+    if (!pagination.hasMore) {
+      if (
+        pagination.nextOffset !== null ||
+        expectedNextOffset !== expectedTotal ||
+        documents.length !== expectedTotal
+      ) {
+        throw new Error(
+          "list-documents claimed exhaustion before every declared document was returned.",
+        );
+      }
+      return documents;
+    }
+    if (
+      pagination.nextOffset !== expectedNextOffset ||
+      pagination.nextOffset <= offset
+    ) {
+      throw new Error(
+        "list-documents returned a non-advancing continuation; refusing a clipped result.",
+      );
+    }
+    offset = pagination.nextOffset;
+  }
+}
+
 export function documentPropertiesQueryKey(
   documentId: string,
   databaseId: string,
@@ -317,11 +387,19 @@ export function seedDatabaseItemDocumentCaches(
 }
 
 export function useDocuments() {
-  return useActionQuery<Document[]>("list-documents", undefined, {
-    select: (data: any) => {
-      const docs = data?.documents ?? data;
-      return Array.isArray(docs) ? docs : [];
-    },
+  return useQuery({
+    queryKey: LIST_DOCUMENTS_QUERY_KEY,
+    queryFn: async ({ signal }) => ({
+      documents: await fetchCompleteDocumentList((offset, limit) =>
+        callAction<DocumentListResponse>(
+          "list-documents",
+          { offset, limit },
+          { method: "GET", signal },
+        ),
+      ),
+    }),
+    select: (data) => data.documents,
+    retry: false,
   });
 }
 

package/corpus/templates/content/shared/api.ts

@@ -128,6 +128,16 @@ export interface DocumentMoveRequest {
 
 export interface DocumentListResponse {
   documents: Document[];
+  pagination: DocumentDiscoveryPagination;
+}
+
+export interface DocumentDiscoveryPagination {
+  offset: number;
+  limit: number;
+  totalItems: number;
+  returnedItems: number;
+  hasMore: boolean;
+  nextOffset: number | null;
 }
 
 export interface DocumentTreeNode extends Document {

package/corpus/templates/design/.agents/skills/delegate-to-agent/SKILL.md

@@ -49,6 +49,34 @@ sendToAgentChat({
 });
 ```
 
+### Keep user text separate from injected context
+
+Treat the visible `message` as the user's request or the shortest clear
+description of an app-initiated operation. Put context the user did not type —
+IDs, URLs, filenames, current selection or screen state, serialized records,
+upload instructions, and bounded source excerpts — in the `context` field.
+`context` is model input carried through the agent turn; it is stripped from
+the rendered user message, so do not concatenate it into `message` with labels,
+blank-line sections, or `<context>` tags yourself.
+
+Use the related surface for each kind of supporting input:
+
+| Surface | Use for |
+| --- | --- |
+| `message` | User-authored intent or a concise app action description |
+| `context` | Derived metadata and bounded text needed to carry out that intent |
+| `setAgentChatContextItem` | Context staged for a later user-submitted prompt; keep it keyed so updates replace stale context |
+| `images`, `referenceImagePaths`, attachments | Binary or visual inputs; describe only the handling instructions in `context` |
+
+If an app builds a prompt from a form, selection, upload, or editor state, keep
+the visible message short and pass the assembled details as `context`. Preserve
+the user's actual freeform text in `message` when it is the request; do not
+restate it as metadata in `context` unless the agent needs a structured copy.
+
+This boundary applies to auto-submitted turns and prefills. A hidden context
+field is not a license to send unbounded records or secrets: cap excerpts,
+prefer stable IDs and URLs, and use an action or resource lookup for full data.
+
 **From the UI, in the background:**
 
 ```ts

package/corpus/templates/design/.agents/skills/frontend-design/SKILL.md

@@ -168,6 +168,11 @@ the useful information remains dense and scannable.
 - Do not build custom dropdowns, menus, popovers, modals, or confirmations with manual absolute positioning and click-outside effects.
 - Never use browser dialogs (`window.alert`, `window.confirm`, `window.prompt`). Use `AlertDialog`, `Dialog`, or app-specific confirmation UI.
 - Use Tabler icons for all first-party UI icons. Do not add Lucide, Heroicons, inline SVG icon sets, or emoji icons.
+- Never guess a Tabler icon name. Names like `IconPartyPopper` or `IconConfettiCannon` feel
+  plausible but don't exist and crash Vite with a "Named export not found" error. Before importing
+  an icon you haven't used elsewhere in this app, confirm it exists by grepping
+  `node_modules/@tabler/icons-react/dist/tabler-icons-react.d.ts` (or the package's icon list)
+  for the exact name, and pick the closest real match if your first guess isn't there.
 - Keep inline help/info glyphs next to labels at `size-3` (12px) or smaller than the adjacent text. Preserve a larger hit area on the trigger, not the glyph. Use `guard:allow-large-help-icon` only for deliberate heading documentation or menu action exceptions.
 - Use `useActionQuery` and `useActionMutation` from `@agent-native/core/client` for action-backed UI. Standard CRUD should go through actions, not custom `/api/` routes.
 - Keep UI optimistic where possible: update cache and navigation immediately, then reconcile or roll back on mutation result.

package/corpus/templates/design/app/pages/DesignSystemSetup.tsx

@@ -555,9 +555,13 @@ export default function DesignSystemSetup() {
       }. Present a summary for review.`,
     );
 
+    const message =
+      parts[0] ?? "Set up a design system from the selected sources.";
+    const context = parts.slice(1).join("\n");
     openAgentSidebar();
     sendToDesignAgentChat({
-      message: parts.join("\n"),
+      message,
+      context,
       submit: true,
       newTab: true,
     });

package/corpus/templates/design/changelog/2026-08-11-design-agent-prompts-copy-successfully-in-the-desktop-app.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-08-11
+---
+
+Design agent prompts copy successfully in the desktop app.

package/corpus/templates/dispatch/.agents/skills/delegate-to-agent/SKILL.md

@@ -49,6 +49,34 @@ sendToAgentChat({
 });
 ```
 
+### Keep user text separate from injected context
+
+Treat the visible `message` as the user's request or the shortest clear
+description of an app-initiated operation. Put context the user did not type —
+IDs, URLs, filenames, current selection or screen state, serialized records,
+upload instructions, and bounded source excerpts — in the `context` field.
+`context` is model input carried through the agent turn; it is stripped from
+the rendered user message, so do not concatenate it into `message` with labels,
+blank-line sections, or `<context>` tags yourself.
+
+Use the related surface for each kind of supporting input:
+
+| Surface | Use for |
+| --- | --- |
+| `message` | User-authored intent or a concise app action description |
+| `context` | Derived metadata and bounded text needed to carry out that intent |
+| `setAgentChatContextItem` | Context staged for a later user-submitted prompt; keep it keyed so updates replace stale context |
+| `images`, `referenceImagePaths`, attachments | Binary or visual inputs; describe only the handling instructions in `context` |
+
+If an app builds a prompt from a form, selection, upload, or editor state, keep
+the visible message short and pass the assembled details as `context`. Preserve
+the user's actual freeform text in `message` when it is the request; do not
+restate it as metadata in `context` unless the agent needs a structured copy.
+
+This boundary applies to auto-submitted turns and prefills. A hidden context
+field is not a license to send unbounded records or secrets: cap excerpts,
+prefer stable IDs and URLs, and use an action or resource lookup for full data.
+
 **From the UI, in the background:**
 
 ```ts

package/corpus/templates/dispatch/.agents/skills/frontend-design/SKILL.md

@@ -168,6 +168,11 @@ the useful information remains dense and scannable.
 - Do not build custom dropdowns, menus, popovers, modals, or confirmations with manual absolute positioning and click-outside effects.
 - Never use browser dialogs (`window.alert`, `window.confirm`, `window.prompt`). Use `AlertDialog`, `Dialog`, or app-specific confirmation UI.
 - Use Tabler icons for all first-party UI icons. Do not add Lucide, Heroicons, inline SVG icon sets, or emoji icons.
+- Never guess a Tabler icon name. Names like `IconPartyPopper` or `IconConfettiCannon` feel
+  plausible but don't exist and crash Vite with a "Named export not found" error. Before importing
+  an icon you haven't used elsewhere in this app, confirm it exists by grepping
+  `node_modules/@tabler/icons-react/dist/tabler-icons-react.d.ts` (or the package's icon list)
+  for the exact name, and pick the closest real match if your first guess isn't there.
 - Keep inline help/info glyphs next to labels at `size-3` (12px) or smaller than the adjacent text. Preserve a larger hit area on the trigger, not the glyph. Use `guard:allow-large-help-icon` only for deliberate heading documentation or menu action exceptions.
 - Use `useActionQuery` and `useActionMutation` from `@agent-native/core/client` for action-backed UI. Standard CRUD should go through actions, not custom `/api/` routes.
 - Keep UI optimistic where possible: update cache and navigation immediately, then reconcile or roll back on mutation result.

package/corpus/templates/dispatch/app/global.css

@@ -29,7 +29,7 @@
   --ring: 0 0% 40%;
   --radius: 0.5rem;
   --sidebar-background: 0 0% 97%;
-  --sidebar-foreground: 0 0% 45%;
+  --sidebar-foreground: 0 0% 43%;
   --sidebar-primary: 0 0% 15%;
   --sidebar-primary-foreground: 0 0% 100%;
   --sidebar-accent: 0 0% 95%;
@@ -60,7 +60,7 @@
   --ring: 0 0% 60%;
   --radius: 0.5rem;
   --sidebar-background: 0 0% 10%;
-  --sidebar-foreground: 0 0% 60%;
+  --sidebar-foreground: 0 0% 62%;
   --sidebar-primary: 0 0% 75%;
   --sidebar-primary-foreground: 0 0% 10%;
   --sidebar-accent: 0 0% 16%;

package/corpus/templates/dispatch/changelog/2026-08-10-desktop-workspace-sign-in.md

@@ -0,0 +1,6 @@
+---
+type: added
+date: 2026-08-10
+---
+
+Desktop workspace sign-in can now be rolled out gradually while ordinary app sign-in remains unchanged by default.

package/corpus/templates/dispatch/changelog/2026-08-11-dispatch-no-longer-shows-the-generic-chat-starter-among-defa.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-08-11
+---
+
+Dispatch no longer shows the generic Chat starter among default app launchers

package/corpus/templates/dispatch/changelog/2026-08-11-integrations-and-scheduled-work-open-as-first-class-electron-pages.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-08-11
+---
+
+Integrations and scheduled work open as first-class Electron pages without a duplicate Dispatch navigation shell.

package/corpus/templates/dispatch/changelog/2026-08-11-sidebar-text-is-slightly-easier-to-read-in-light-and-dark-mo.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-08-11
+---
+
+Sidebar text is slightly easier to read in light and dark mode.

package/corpus/templates/dispatch/server/lib/identity-sso.ts

@@ -43,26 +43,30 @@ export const IDENTITY_TOKEN_TTL = "2m";
 /** JWT `scope` claim marking this as an identity (login) token, not A2A/MCP. */
 export const IDENTITY_SCOPE = "identity";
 
-/**
- * Host suffixes that a `redirect_uri` may belong to. This is the core
- * open-redirect / token-theft guard: an attacker-supplied `redirect_uri`
- * pointing anywhere else would exfiltrate the identity token.
- *
- * `.agent-native.com` covers every first-party hosted app
- * (mail.agent-native.com, calendar.agent-native.com, …) — the shared
- * first-party prod-URL registry is exactly the `*.agent-native.com`
- * subdomain space, so a suffix check is both sufficient and the least
- * footgun-prone (no per-app list to keep in sync).
- *
- * These are matched as DOT-prefixed suffixes against the parsed URL
- * hostname, so `agent-native.com.evil.com` does NOT match
- * `.agent-native.com` (it ends in `.evil.com`), and a bare
- * `agent-native.com` apex is intentionally NOT matched (all first-party
- * apps are subdomains; the apex is the marketing site).
- */
-export const DEFAULT_ALLOWED_HOST_SUFFIXES: readonly string[] = [
-  ".agent-native.com",
-];
+/** Exact first-party clients trusted to receive identity tokens. */
+export const CANONICAL_IDENTITY_SSO_APP_ORIGINS = {
+  analytics: "https://analytics.agent-native.com",
+  assets: "https://assets.agent-native.com",
+  brain: "https://brain.agent-native.com",
+  calendar: "https://calendar.agent-native.com",
+  chat: "https://chat.agent-native.com",
+  clips: "https://clips.agent-native.com",
+  content: "https://content.agent-native.com",
+  crm: "https://crm.agent-native.com",
+  design: "https://design.agent-native.com",
+  dispatch: "https://dispatch.agent-native.com",
+  forms: "https://forms.agent-native.com",
+  macros: "https://macros.agent-native.com",
+  mail: "https://mail.agent-native.com",
+  plan: "https://plan.agent-native.com",
+  slides: "https://slides.agent-native.com",
+  tasks: "https://tasks.agent-native.com",
+} as const;
+
+export const DEFAULT_ALLOWED_ORIGINS: readonly string[] = Object.values(
+  CANONICAL_IDENTITY_SSO_APP_ORIGINS,
+);
+const IDENTITY_SSO_CALLBACK_PATH = "/_agent-native/identity/callback";
 
 /** Loopback hosts allowed for local development of the client side. */
 const LOCALHOST_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
@@ -102,14 +106,11 @@ export function getConfiguredHostSuffixes(
  *      `http:` is also allowed (TLS is not available on localhost).
  *   3. It has no embedded credentials (`user:pass@host`) — those are an
  *      open-redirect obfuscation vector.
- *   4. Its hostname is either a loopback host, OR ends in one of the
- *      allowed host suffixes (default `.agent-native.com`, plus any
- *      configured via env). The suffix is matched against the FULL parsed
- *      hostname with a leading dot, so `agent-native.com.evil.com` is
- *      rejected (ends in `.evil.com`) and substring spoofs cannot pass.
+ *   4. Its origin is an exact registered first-party app, a loopback host,
+ *      or an operator-configured extra host suffix.
  *
- * Everything else is rejected. Fragments/queries on the URI are allowed
- * (the client may have its own) — we append our params safely.
+ * Everything else is rejected. The authorize endpoint adds a second check
+ * that binds the app id to the exact origin and callback path.
  */
 export function isAllowedRedirectUri(
   rawRedirectUri: unknown,
@@ -145,10 +146,9 @@ export function isAllowedRedirectUri(
 
   if (isLoopback) return true;
 
-  const suffixes = [
-    ...DEFAULT_ALLOWED_HOST_SUFFIXES,
-    ...(options.allowedHostSuffixes ?? getConfiguredHostSuffixes()),
-  ];
+  if (DEFAULT_ALLOWED_ORIGINS.includes(url.origin)) return true;
+
+  const suffixes = options.allowedHostSuffixes ?? getConfiguredHostSuffixes();
 
   // Suffix match against the full hostname, leading-dot anchored so a
   // sibling/parent host can never satisfy a child's suffix:
@@ -158,6 +158,32 @@ export function isAllowedRedirectUri(
   return suffixes.some((suffix) => hostname.endsWith(suffix));
 }
 
+const APP_ID = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+
+export function isAllowedIdentityRedirect(
+  appId: unknown,
+  rawRedirectUri: unknown,
+  options: { allowedHostSuffixes?: readonly string[] } = {},
+): boolean {
+  if (typeof appId !== "string" || !APP_ID.test(appId)) return false;
+  if (!isAllowedRedirectUri(rawRedirectUri, options)) return false;
+
+  const url = new URL(rawRedirectUri as string);
+  if (url.pathname !== IDENTITY_SSO_CALLBACK_PATH || url.search || url.hash) {
+    return false;
+  }
+
+  if (DEFAULT_ALLOWED_ORIGINS.includes(url.origin)) {
+    return (
+      CANONICAL_IDENTITY_SSO_APP_ORIGINS[
+        appId as keyof typeof CANONICAL_IDENTITY_SSO_APP_ORIGINS
+      ] === url.origin
+    );
+  }
+
+  return true;
+}
+
 export interface IdentityClaims {
   /** Stable user identifier — the Dispatch account email. */
   sub: string;

package/corpus/templates/dispatch/server/plugins/feature-flags.ts

@@ -0,0 +1,5 @@
+import { createFeatureFlagsPlugin } from "@agent-native/core/server";
+
+import { DISPATCH_FEATURE_FLAGS } from "../../shared/feature-flags.js";
+
+export default createFeatureFlagsPlugin({ flags: DISPATCH_FEATURE_FLAGS });

package/corpus/templates/dispatch/server/plugins/identity-sso.ts

@@ -8,8 +8,8 @@
  *      unauthenticated visitor here with:
  *        ?app=<id>&redirect_uri=<https url>&state=<opaque>
  *
- *   2. We validate `redirect_uri` against the strict allowlist
- *      (`isAllowedRedirectUri`). An invalid/forbidden value is rejected
+ *   2. We bind `app` and `redirect_uri` against the strict allowlist
+ *      (`isAllowedIdentityRedirect`). An invalid/forbidden pair is rejected
  *      with 400 BEFORE any session work — an attacker-controlled
  *      `redirect_uri` must never receive a token. This is the single most
  *      important control on this endpoint.
@@ -49,42 +49,40 @@
  *   This is documented as the chosen trade-off.
  *
  * Auth-guard reachability:
- *   `/_agent-native/*` is 401'd by the core auth guard when there is no
- *   session, which would break the logged-OUT bounce. So this plugin
- *   registers the exact path `/_agent-native/identity/authorize` as a
- *   `publicPath` via a second `createAuthPlugin({ publicPaths })` call.
- *   When two `createAuthPlugin` calls run in the same server boot on the
- *   same Nitro app, the framework APPENDS publicPaths to the live guard
- *   config (it does not clobber Dispatch's googleOnly/marketing/onboarding
- *   — verified in packages/core/src/server/auth.ts). The path is matched
- *   exactly (or as a `/`-segment prefix), so ONLY the authorize endpoint
- *   becomes public; any future `/_agent-native/identity/*` route stays
- *   protected. The handler then resolves the session ITSELF (exactly the
- *   `/_agent-native/open` pattern) — public-path only means "guard does not
- *   pre-empt", not "no auth": logged-out users are still bounced to login,
- *   and a token is only minted for a real session.
+ *   Dispatch's primary auth plugin receives the exact public paths from
+ *   `setupDispatch`. These handlers still resolve the session themselves;
+ *   public-path only means the guard does not pre-empt the logged-out bounce.
  */
 
 import { signA2AToken } from "@agent-native/core/a2a";
-import { getOrgDomain } from "@agent-native/core/org";
 import {
-  createAuthPlugin,
-  getH3App,
-  getSession,
-} from "@agent-native/core/server";
+  getFeatureFlagRules,
+  isFeatureFlagEnabled,
+  normalizeFeatureFlagRules,
+} from "@agent-native/core/feature-flags";
+import { getOrgDomain } from "@agent-native/core/org";
+import { getH3App, getSession } from "@agent-native/core/server";
 import { signInJourney } from "@agent-native/core/shared";
-import { defineEventHandler, getMethod } from "h3";
+import { defineEventHandler, getHeader, getMethod } from "h3";
 import type { H3Event } from "h3";
 
+import { DESKTOP_WORKSPACE_SSO_FLAG } from "../../shared/feature-flags.js";
 import {
   IDENTITY_TOKEN_TTL,
   buildIdentityClaims,
   buildRedirectLocation,
-  isAllowedRedirectUri,
+  isAllowedIdentityRedirect,
 } from "../lib/identity-sso.js";
 
-/** Exact path. Registered as a publicPath so the guard does not 401 it. */
+const AVAILABILITY_PATH = "/_agent-native/identity/availability";
 const AUTHORIZE_PATH = "/_agent-native/identity/authorize";
+const DESKTOP_SSO_CANARY_USER_AGENT = /AgentNativeDesktopSsoCanary\//i;
+
+export function isDesktopWorkspaceSsoRequest(
+  userAgent: string | undefined,
+): boolean {
+  return DESKTOP_SSO_CANARY_USER_AGENT.test(userAgent ?? "");
+}
 
 function getRequestUrl(event: H3Event): string {
   return (event as any).node?.req?.url ?? (event as any).path ?? "/";
@@ -93,7 +91,10 @@ function getRequestUrl(event: H3Event): string {
 function jsonResponse(body: unknown, status: number): Response {
   return new Response(JSON.stringify(body), {
     status,
-    headers: { "Content-Type": "application/json" },
+    headers: {
+      "Cache-Control": "private, no-store",
+      "Content-Type": "application/json",
+    },
   });
 }
 
@@ -118,6 +119,45 @@ async function resolveOrgDomain(
   }
 }
 
+export async function canAttemptWorkspaceSso(): Promise<boolean> {
+  const stored = await getFeatureFlagRules(
+    DESKTOP_WORKSPACE_SSO_FLAG.key,
+    {},
+  ).catch(() => null);
+  if (!stored) return false;
+  const rules = normalizeFeatureFlagRules(stored);
+  if (rules.mode === "off") return false;
+  if (rules.mode === "on") return true;
+  return (
+    rules.emails.length > 0 || rules.orgIds.length > 0 || rules.percentage > 0
+  );
+}
+
+export async function isWorkspaceSsoEnabledForSession(
+  session: Awaited<ReturnType<typeof getSession>>,
+): Promise<boolean> {
+  if (!session?.email) return false;
+  return isFeatureFlagEnabled(DESKTOP_WORKSPACE_SSO_FLAG, {
+    userEmail: session.email,
+    userKey: session.email,
+    orgId: session.orgId,
+  }).catch(() => false);
+}
+
+const availabilityHandler = defineEventHandler(
+  async (event: H3Event): Promise<Response> => {
+    const method = getMethod(event);
+    if (method !== "GET" && method !== "HEAD") {
+      return jsonResponse({ error: "Method not allowed" }, 405);
+    }
+    const session = await getSession(event).catch(() => null);
+    const available = session?.email
+      ? await isWorkspaceSsoEnabledForSession(session)
+      : await canAttemptWorkspaceSso();
+    return jsonResponse({ available }, 200);
+  },
+);
+
 const authorizeHandler = defineEventHandler(
   async (event: H3Event): Promise<Response> => {
     const method = getMethod(event);
@@ -134,11 +174,15 @@ const authorizeHandler = defineEventHandler(
     }
 
     const redirectUri = search.get("redirect_uri");
+    const appId = search.get("app");
     const state = search.get("state");
+    const isDesktopRequest = isDesktopWorkspaceSsoRequest(
+      getHeader(event, "user-agent"),
+    );
 
     // ---- Control 1: redirect_uri allowlist (BEFORE any session work) ----
     // An attacker-supplied redirect_uri must never reach the mint path.
-    if (!isAllowedRedirectUri(redirectUri)) {
+    if (!isAllowedIdentityRedirect(appId, redirectUri)) {
       return jsonResponse(
         {
           error: "invalid_redirect_uri",
@@ -150,9 +194,13 @@ const authorizeHandler = defineEventHandler(
         400,
       );
     }
-    // Narrowed to string by isAllowedRedirectUri.
+    // Narrowed to string by isAllowedIdentityRedirect.
     const safeRedirectUri = redirectUri as string;
 
+    if (isDesktopRequest && !(await canAttemptWorkspaceSso())) {
+      return jsonResponse({ error: "not_found" }, 404);
+    }
+
     // ---- Resolve the EXISTING Dispatch session --------------------------
     const session = await getSession(event).catch(() => null);
 
@@ -182,6 +230,10 @@ const authorizeHandler = defineEventHandler(
       return redirect(signInHref);
     }
 
+    if (isDesktopRequest && !(await isWorkspaceSsoEnabledForSession(session))) {
+      return jsonResponse({ error: "not_found" }, 404);
+    }
+
     // ---- Mint the short-lived identity token ----------------------------
     if (!process.env.A2A_SECRET) {
       // Without a shared secret, no first-party app could verify the token.
@@ -238,13 +290,10 @@ const authorizeHandler = defineEventHandler(
 );
 
 /**
- * Dispatch identity-SSO plugin. Mounts the authorize route and registers
- * its exact path as a public path so the core auth guard does not 401 the
- * logged-out bounce. The `createAuthPlugin({ publicPaths })` call is
- * additive — it appends to the live guard config without disturbing the
- * primary Dispatch auth plugin's googleOnly/marketing/onboarding config.
+ * Dispatch identity-SSO plugin. The primary Dispatch auth plugin owns the
+ * exact public-path registration; this plugin owns only these handlers.
  */
 export default async (nitroApp: any) => {
+  getH3App(nitroApp).use(AVAILABILITY_PATH, availabilityHandler);
   getH3App(nitroApp).use(AUTHORIZE_PATH, authorizeHandler);
-  return createAuthPlugin({ publicPaths: [AUTHORIZE_PATH] })(nitroApp);
 };